A new platform on Amazon EKS hosts web applications that developers frequently update. Developers currently build Docker images and deploy them manually. The company wants an automated pipeline and must receive an SNS notification when ECR image scanning reports any HIGH or CRITICAL findings for OS or language-package vulnerabilities. Which combination of steps satisfies these needs? (Choose two.)

The first correct option describes setting up a CodeCommit repository for source control, a CodePipeline for orchestration, and using EventBridge to trigger the pipeline on changes to the Dockerfile. This is the standard AWS approach for automating CI/CD workflows, where CodeBuild would then handle the image building. EventBridge provides flexible event-driven triggers. The second correct option focuses on the image scanning and notification requirement. It correctly specifies using enhanced ECR image scanning, which provides more comprehensive vulnerability detection than basic scanning. An EventBridge rule listening for ECR image scan events is the appropriate mechanism to detect specific findings (CRITICAL or HIGH) and trigger an SNS notification. The incorrect options propose less efficient or incorrect methods. Using an S3 event to trigger CodePipeline is not standard for source code changes. Watching GuardDuty events for ECR image scans is incorrect; GuardDuty is for threat detection, not ECR vulnerability scanning. Scanning the Dockerfile before building is not how ECR image scanning works; ECR scans the built image.